feat: AVE-2026-00060 through 00064 -- five new records from policy/config-surface audit

[chaksaray]

Summary

Five new records from a coordinated policy/config-surface audit pass, record set now at 64:

AVE ID	Title	Severity	AIVSS
AVE-2026-00060	STDIO transport shell injection via unsanitized tool call parameters	HIGH	7.2
AVE-2026-00061	TLS certificate verification disabled in agent component configuration	MEDIUM	4.1
AVE-2026-00062	Unpinned dependency version allowing supply chain substitution	MEDIUM	4.4
AVE-2026-00063	Human approval gate bypassed via declarative configuration	MEDIUM	4.8
AVE-2026-00064	Zero-click code execution via project-load auto-run configuration	MEDIUM	5.2

AVE-2026-00063 was checked against AVE-2026-00048 before drafting and kept as a separate record: different entry_class (registry_metadata vs content), different payload_surface (a declarative config flag vs instruction text) — the record-growth discipline's mechanical test, applied, not re-litigated during implementation.

Fix applied during implementation

AVE-2026-00061's draft mitigation.enforcement_point was "registry_metadata", which is not a valid enum value in the schema (valid set: static_scan, server_card_fetch, runtime_proxy, agent_framework, downstream_system, network_layer). Corrected to static_scan, matching the record's own content detection_layer. Confirmed via direct schema inspection, not assumed.

Validation

• AIVSS arithmetic independently recomputed for all 5 records: all match stated scores.
• python3 scripts/validate_records.py: all 64 records valid.
• python3 scripts/check_fixtures.py: all 64 records have positive + negative fixtures.
• pytest tests/ -x -q: 256 passed.
• No vendor boilerplate (bawbel-scanner, piranha, etc.) in any of the 5 new records.
• node scripts/build-records.js: dist/ave-records-latest.json + manifest regenerated; frozen dist/ave-records-v1.1.0.json snapshot correctly left untouched (no schema bump).

Scope notes

• No detection-rule PR opened in bawbel/scanner as part of this PR -- that's a separate, coordinated PR in that repo's own tracker per CONTRIBUTING.md Step 4, not requested here.
• README.md's record count/badge/index (currently 59) and CONTEXT.md's count are not updated here, matching the add-ave-record skill's own Step 7 scope (dist/ + CHANGELOG.md only) -- this drift already predates this PR (CLAUDE.md still says "56 published").